Arbitrum freezes $189 million in ETH tied to Binance exploit

At 8:08 a.m. HKT on October 30, Arbitrum’s Security Council froze 8,425 ETH and 74,559,805.2 ARB linked to a Binance hot-wallet exploit, holding both at0x0000000000000000000000000000000000000DA0; the forum says the funds can be moved only through an ArbitrumDAO governance vote. The action is documented on the Arbitrum Foundation Forum.

At CoinGecko‘s stated price of $2,245.94, the 8,425 ETH alone works out to $189,178,843.50. No ARB price appears in the available record, so the combined figure is at minimum that, plus whatever 74,559,805.2 ARB is worth when you’re reading this.

The Arbitrum Foundation was direct: “Funds associated with the Binance exploit are frozen on Arbitrum One. No other user’s funds or applications were affected.” It also confirmed the council “executed an emergency action to freeze 8,425 ETH and 74,559,805.2 ARB held on Arbitrum One by an address identified with today’s Binance exploit.”

Binance’s incident announcement pointed away from a private-key breach. The Binance Team’s initial investigation suggested “a compromised DevOps engineer’s laptop” allowed an attacker to access a service container and submit unauthorized withdrawal transactions. “We have found no evidence of any wallet private key leak,” the company said. Binance put total impact at roughly $6.3 billion, said about $3 billion of affected assets — approximately 47.6% of its own damage figure — had been frozen on-chain, and said it would cover all losses through the SAFU fund and company funds. Deposits and withdrawals were temporarily suspended.

The timeline, drawn from the Aave governance account, suggests the compromise remained active after responders engaged. The first movement came at 20:24 UTC on October 29: a Binance hot wallet sent roughly 63 tokens and 167,464 ETH to a single address. A second hot wallet followed with another 28,006 ETH to the exploiter. Funds on Arbitrum, Optimism, and Avalanche moved within minutes. Then at 23:04 UTC — more than two hours after the initial Ethereum drain — a further 444,537 AVAX arrived on Avalanche.

Between 20:58 and 21:01 UTC, one wallet in the exploiter’s cluster supplied 60 million USDT$0.9989▼0.01% on Aave V3 Ethereum Core and borrowed 19,762 WETH. Across all Aave networks and versions, that position carried $59.9 million of USDT collateral against $43.8 million of debt. Aave Governance described it as over-collateralized and subject to normal liquidation: “It does not put Aave suppliers at risk.”

Aave’s response, documented on the Aave Governance Forum, was broad. Guardian multisigs froze 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks, executing those transactions between 21:42 and 23:04 UTC — after the exploiter’s borrowing activity, before Arbitrum’s council acted. Slope2 parameters on V3 and V4 were also reduced, though the available record doesn’t include the specific values or any staged-unfreeze schedule. The Horizon RWA market stayed open; its collateral is permissioned.

On the frozen reserves, users cannot open new supply or borrow positions but can repay debt and withdraw collateral; the permissioned Horizon RWA market was not frozen.

Price movement accompanied the exploit and response, though causation is harder to pin. As of 00:55 UTC, BTC$78,047.00▼2.19% and ETH were both down roughly 4% from before the drain; AAVE and LINK had each dropped around 9%, UNI around 8%, ARB around 6%. GHO slipped from about $0.998 to $0.997 as holders redeemed approximately 4.6 million GHO for USDT between 21:49 and 22:07 UTC.

The frozen ETH and ARB remain at the specified address; the fact sheet does not provide a date for the required governance vote.